Secure management script deployment

Abstract

An indication is received to initiate a resource discovery process of a client system. The client system includes resources to be discovered and the resource discovery process is associated with a script. A connection is made from a management server to the client system with a first level of security privileges of the client system. The client system is provided with an encapsulation program for an execution of the script. The encapsulation program is configured to determine ownership information of the script. The encapsulation program is also configured to cause the execution of the script on the client system with modified security privileges corresponding to the ownership information of the script rather than the first level of security privileges of the client system.

What is claimed is: 
     
       1. A method, comprising:
 receiving an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script; 
 connecting from a management server to the client system with a first level of security privileges of the client system; 
 providing to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and 
 tracking the modified security privileges associated with the execution of the execution command including by:
 receiving a record of the modified security privileges associated with the execution of the execution command; and 
 storing the received record of the modified security privileges associated with the execution of the execution command. 
 
 
     
     
       2. The method of  claim 1 , further comprising:
 receiving a description of the resources of the client system at the management server; and 
 storing the received description of the resources of the client system. 
 
     
     
       3. The method of  claim 1 , wherein the script is a custom discovery script, and wherein the custom discovery script includes execution requests for a plurality of commands on the client system. 
     
     
       4. The method of  claim 1 , wherein the first level of security privileges of the client system are administrative security privileges. 
     
     
       5. The method of  claim 1 , wherein the first level of security privileges of the client system includes more privileges than the modified security privileges corresponding to the ownership information of the execution command. 
     
     
       6. The method of  claim 1 , further comprising removing the provided encapsulation program from the client system. 
     
     
       7. The method of  claim 1 , further comprising uploading the script to the client system. 
     
     
       8. The method of  claim 1 , further comprising providing to the client system a network location of the script for the client system to retrieve. 
     
     
       9. The method of  claim 1 , further comprising initiating deletion of the script from the client system. 
     
     
       10. The method of  claim 1 , wherein the encapsulation program is configured to intercept a plurality of execution commands of the script. 
     
     
       11. The method of  claim 10 , wherein the encapsulation program is configured to: parse the script to identify the execution command of the script. 
     
     
       12. The method of  claim 1 , wherein the ownership information of the execution command includes a user identifier and a group identifier. 
     
     
       13. The method of  claim 12 , wherein the encapsulation program is configured to:
 spawn a new process, wherein the new process is configured using the user identifier associated with the ownership information of the execution command. 
 
     
     
       14. The method of  claim 1 , wherein the ownership information of the execution command includes a path location of the execution command. 
     
     
       15. The method of  claim 1 , wherein security privileges corresponding to the ownership information of the script includes more privileges than the modified security privileges corresponding to the ownership information of the execution command. 
     
     
       16. The method of  claim 1 , further comprising verifying a digital signature of the script. 
     
     
       17. A system, comprising:
 one or more processors; and 
 a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
 receive an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script; 
 connect from a management server to the client system with a first level of security privileges of the client system; 
 provide to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and 
 track the modified security privileges associated with the execution of the execution command including by being configured to:
 receive a record of the modified security privileges associated with the execution of the execution command; and 
 store the received record of the modified security privileges associated with the execution of the execution command. 
 
 
 
     
     
       18. The system of  claim 17 , wherein the first level of security privileges of the client system are administrative security privileges. 
     
     
       19. The system of  claim 17 , wherein the first level of security privileges of the client system includes more privileges than the modified security privileges corresponding to the ownership information of the execution command. 
     
     
       20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
 receiving an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script; 
 connecting from a management server to the client system with a first level of security privileges of the client system; 
 providing to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and 
 tracking the modified security privileges associated with the execution of the execution command including by:
 receiving a record of the modified security privileges associated with the execution of the execution command; and 
 storing the received record of the modified security privileges associated with the execution of the execution command.